Mobile Device/Smartphone Security Tips
Total Page:16
File Type:pdf, Size:1020Kb
Mobile Device/Smartphone Security Tips Author: Jared Hall Revision: 1.3 URL: https://www.jaredsec.com/mobile-devicesmartphone-security-tips/ Date: 07/10/2017 Scope I had originally intended this to be just some simple bullet points to add to my "Life Outside the Firewall" dissertation. As I researched expert opinions and comments, policies from device manufacturers, and combined that with some of my own ideas, this turned out to be a comprehensive article in itself. I own Android devices. I have access to an iPhone. Many years ago, I wrote a Bible Verse App for Android Gingerbread. Five years ago, I compiled an Ice Cream Sandwich ROM for my old Galaxy S2. Presented herein are thirty great tips for preserving mobile device security. I thought writing this post would be an easy task. I was wrong. Introduction In the mobile device world, "iOS versus Android" reminds me of the "Mac versus PC" debates of the late 1980's. In that battle, the PC won because its architecture was more open, bringing down the Total Cost of Ownership (TCO). In the same fashion, Android is the dominate O/S in the mobile world for the same reason: its open architecture. But that doesn't necessarily make Android a better product. If you expect your Phone Carrier and Manufacturer to keep your phone even somewhat current, you'll be buying two Android devices for every iPhone. On the other hand, you'll probably get more productivity out of an Android device. I do not discuss Windows Phone or devices at all in this document. Obviously, their claim-to- fame is compatibility with all the other Windows applications that you use at work. The same security principles apply. As is the case with the desktop PC, Apple is somewhat limited, but what it does, it does well. I found that the average iPhone can be used for about four years from the release date before it becomes obsolete. Apple provides timely security updates throughout the product's lifecycle. One person wrote earlier this year (2017): "The iPhone 5, for example, was released in 2013 but is still getting iOS 10 updates. Conversely, the Nexus 5, which launched at about the same time, saw its last update in December 2015 to Android 6.0 Marshmallow." Alas, the writer spoke too soon. The March 2017 release of iOS 10.3 only supports 64-bit devices, signalling the end of the road for the iPhone 5, iPhone 5c and the fourth-generation iPad. However, the 2013 iPhone 5S (small version) has a 64-bit processor and is still getting updates. A friend of mine just got pushed a 10.3.2 iOS update for his iPhone 5S via AT&T. By contrast, Android phones have a lifespan of two years before obsolescence. This is the mandatory minimum set by the European Union. Even worse, the average Android phone will receive only one OTA update from the manufacturer, despite monthly Android security fixes by Google. Even Google hasn't update their own Nexus and Pixel phones. Many Android users never get any OTA updates for their phones. Google has been working on "Project Treble", a mechanism by which core Android updates can be developed by Google independently of the device manufacturer. This is expected to be the default behavior starting with Android "O" later this year (2017). The program is starting in July 2017, beginning with their own Pixel and Nexus phones. It is not known what, if any, impact "Project Treble" will have on individual Android users. Nobody knows what the response from board manufacturers and Carriers will be. It is more likely that bug fixes will be pushed rather than complete Android updates. But, since Android is an open architecture, there is quite a bit of active ROM (O/S) development for older phones. The more "mainstream" your phone is, the more options you will have available to you. The go-to site, for the technically savvy, is XDA Developers. The product lifespan differences between Android and Apple devices may be dependent upon the microprocessors used. Android devices rely heavily upon Qualcomm "SnapDragon" processors running an ARM instruction set. Google blames their limited lifespan to Qualcomm's processor production runs of two years. Google has stated that they hope to develop and/or brand their own series of microprocessors. Apple has traditionally used their own branded versions of either Samsung or TSMC (Taiwan Semiconductor Manufacturing Company) ARM processors. Most of Apple's latest iPhones use TSMC processors. As always, take what you can, apply what you can, and leave the rest. (1) PASSCODE LOCKS Always use a locking mechanism on your phone, whether it is a pin, or a pattern. Do not use the same PIN as your ATM card. Any Android user should be running Marshmallow (6.0) or later. This requires your unlock code or pattern immediately after a startup or reboot.Use some care when unlocking your phone in public places. Try to keep the phone as close to your chest as possible. Most security cameras these days can easily pick up pattern swipes or PIN entries. 34% of phones have no lock at all. Don't be part of that crowd. (2) SET UP REMOTE WIPE Android user can login to their Google account and perform "Find" and "Erase" functions. This can be done from the Google Dashboard (https://www.google.com/dashboard") or from Android.com ("https://www.android.com/find"). You'll have to login with your Google account credentials. iPhone users have a similar procedure available to them on iCloud.com. If you can't find your device: "When in doubt, wipe it out!" (3) SHUT DOWN WIFI & BLUETOOTH CONNECTIONS This is also important. Your cellphone is likely to connect to any open WiFi hotspot, even those run by miscreants. If you're not using your phone, turn it off. If you're travelling, or may need access to your phone quickly on occasion, buy a Faraday bag and put the phone it it. (4) USE CAUTION WITH OPEN/PUBLIC WIFI NETWORKS If you must use Public WiFi systems, like in a coffee shop or store, make sure that any connection you log into uses an https connection. Otherwise, some creep lurking around with a laptop can sniff the WiFi system and pickup your login credentials. Generally speaking, if all of your apps connect securely through SSL or other encryption mechanisms, this is not much of a problem. But how about your company's Email servers or your personal EMail accounts? And of course, we all have Apps on our phones that we're not sure of - like that Coupon/Sales App, Map Software, Movie App, etc. If you're not sure your Apps communicate securely, don't use them on Public/Open networks. (5) ENCRYPT STORAGE (DATA AT REST) This is a feature available with Android Marshmallow (6.0) and later. This should be enabled whenever possible. Note that with Android, expansion of the internal drive to an external SD- Card is available by means of "Adopted Storage". Applications as well as data can be stored there. Adopted Storage, by default, is encrypted. This is because Google felt that the SD-Card might be removed for inspection by miscreants. (6) ENCRYPT CALLS & TEXTS (DATA IN TRANSIT) There are a variety of applications that can do this. WhatsApp and Telegram are popular. When asked, I will instruct users to use Signal, which can be used to make secure phone calls and texts. The message store for texts can be encrypted as well. It has minimal "Junk"; a simple replacement for your phone's SMS/MMS Messaging application. It is cross-platform; available for iPhone and Android users. It is also the only App approved for use by the US Senate. Signal's Moxie Marlinspike (of SSL fame) developed the encryption protocols that most of the other Apps use. (7) AVOID EMAIL PHISHING The same care you must use on your office workstation applies to your mobile devices as well. Both Android and iPhone devices use "sandbox" techniques which makes them usable again after reboot. But, nothing is perfect. Assuming otherwise will eventually lead to a breach. Don't phall for the phish! (8) CONFIGURE AUTO-ERASE This is the draconian "auto-destruct" feature for the most paranoid of individuals. Since most smartphones have business-oriented data on them, should it fall into enemy competitor's hands, it's better to blow up your phone than compromise your business. This is an available option unique to Apple iPhones when set to high security. There is no active Android equivalent. The smart play for Android users is to use Remote Wipe. (9) ENCRYPT & ANONYMIZE TRANSACTIONS If you have access to a VPN service, use it whenever possible. This ensures that everything you send from your phone will be secure (at least up to the VPN provider's endpoint). You still need to make sure that your Apps communicate securely as well. (10) AVOID PASSWORD REUSE (BUSINESS/PERSONAL) Never use the same password on your mobile device Apps that you use for your business logins. Ever. (11) AVOID PASSWORD REUSE (OAUTH) OAuth is a type of web-based Open Authentication mechanism, similar to RADIUS authentication in the days of Internet dialup. It was originally designed by Twitter to support third-party developers. Apps can authenticate via Twitter, without having to reveal passwords to the OAuth provider. OAuth was subsequently pushed by Google and is now an Internet standard. I'm sure that by now everybody has some App that says "Login with Google" or "Login using Facebook".